syslog message monitoring

I want to monitor syslog messages and want to generate alerts on the orion NPM platform.

I tried using syslog viewer but it only generates the alert with name real time change detection, without any real in formation in the alert as to which rule triggered it.

We are using Orion NPM 12.0.1 SAM 6.3 and NCM 7.5

All the help is appreciated.

Thanks

Find more posts tagged with

syslog events

sam

npm 12.x

syslog_alerts

ncm 7.x

rule

Accepted answers

ebradford

Interesting. I was just working on this same topic earlier this week, and part of a different focus. I have a solution for you, it requires creating Custom SQL alerts. I have posted it here, check it out.
SQL: How to search syslog for specific messages

All comments

zackm

Can you be more specific in your request?

I want to monitor syslog messages and want to generate alerts on the orion NPM platform.

Sure, there's a few different options to do this depending on your specific needs.

I tried using syslog viewer but it only generates the alert with name real time change detection, without any real in formation in the alert as to which rule triggered it

Are you saying that the Syslog Viewer only has one rule, named "Real Time Change Detection", or that out of all of your rules, that's the only one that triggers? Also, what are you expecting to see in the alert itself, what kind of data?

faizan_123

If i receive a syslog message such as "node down" i need to be able to create an alert in NPM orion alert view for that syslog message . This is just an example we dont want receive all the syslog message as alerts but we need a selected few.

As for data we want the time , message and from where it originated.

ebradford

zackm

faizan_123 ^^^ this is the proper path to take if you want to use the native alerting engine in Orion.

Otherwise, to use the Syslog Viewer alerting; see this guide: Configure Syslog Viewer rules - SolarWinds Worldwide, LLC. Help and Support

superfly

In syslog viewer you can create as many rules as you like. Just add in a new rule, put in the details of the syslog you're looking for, configure up an email alert for it and you're done. I've used it for all sorts of alerts like temp warnings, power supply failures, bgp neighbour alerts etc.

i recommend your first rule (after RTCD) to be a rule that forwards all syslog 0, 1 & 2's. That way you'll get everything that is deemed important emailed to you. Oddly things like power supply failures, BGP neighbour drops etc, are only rated a syslog 3 or 4. But if you forward all of the syslog 3 & 4's, you'll be inundated with emails!